Temporary Credentials

Short-lived credentials end to end: the five AWS STS operations and when each applies, the two-policy role model, session duration and the one-hour role-chaining cap, cross-account trust and the confused-deputy defences, IAM Roles Anywhere for workloads off AWS, S3 presigned URLs, and the narrowing-only power of session policies and session tags.

Content current as of 2026-10.

Lessons

1. STS and AssumeRole
2. Cross-account trust and the confused deputy
3. Roles Anywhere and presigned URLs
4. Session policies and session tags

Sources

• SCS-C03 exam guide — Content Domain 4 (tasks 4.1–4.2)
• AWS STS API reference — AssumeRole
• IAM User Guide — cross-account policy evaluation logic
• IAM User Guide — the confused deputy problem
• IAM Roles Anywhere user guide
• Amazon S3 user guide — presigned URLs